[vbox-dev] apt-key is deprecated - please update install page accordingly

[Klaus Espenlaub]

Hello Arnaldo,

On 2022-02-28 16:41, Arnaldo Pirrone wrote:
> Hello,
> 
> Please note that apt-key has been deprecated for a while and apt is now 
> complaining every time it finds stuff into /etc/apt/trusted.gpg.d

Thanks for pointing it out.

Where has this been announced, and which Debian/Ubuntu releases are the 
oldest ones supporting the new mechanism?

It seems to me that the answers are surprisingly difficult to find.

Not blaming you as the messenger, of course.

However to do this transition properly we need to know.

(I guess they were on display at the local planning department at Alpha 
Centauri, for those who understand the joke.)

> so it's about time to edit the Linux_Downloads page to instruct all 
> debian users to copy the keys into /usr/local/share/keyrings

Right, I agree. Depends on answers to the above unfortunately.

> and update the interested /etc/apt/sources.list.d file by interposing 
> [signed-by=/usr/local/share/keyrings/oracle_vbox_2016.asc] between the 
> keyword deb and the repository address.
> 
> I see there are actually two keys for debian, oracle_vbox_2016.asc and 
> oracle_vbox.asc, not sure which uses which, can you please point out if 
> they are both needed, or make a single one.

For really old VirtualBox packages (which implies for really old 
Debian/Ubuntu versions which for most users shouldn't matter any more) 
you need oracle_vbox_2016.asc because back then they wouldn't accept key 
lengths which today are considered a must have.

Might be an opportunity to split out the "old Debian/Ubuntu" information 
to a different page. Who knows, maybe someone wants to run really old 
VirtualBox for double vintage computing.

Thanks again,
Klaus

> 
> Thank you